2.9 Blending government change with reality

---

In Chapter 1, we reviewed many of the changes that the federal government has initiated to address homeland security. In this chapter we examined results of a survey that shows the status of homeland security-related IS management practices and that clearly shows that not all organizations have achieved high levels of security planning and training.

Based on the information presented in this chapter, IT managers should follow the steps in Action Checklist Number 2 (see Table 2.21), including evaluating the condition of IS security policies, plans, and procedures in their organizations. The next chapter examines the implementation of the security of critical infrastructures.

Table 2.21: Action Checklist Number 2

Action Item	Status (e.g., Completed, Pending, or N/A)
Evaluate changes in IT management practices that were made as a result of terrorist attacks of September 11, 2001, to determine if new procedures are still adequate to address current security conditions or needs.
Evaluate changes in IT management practices that were made as a result of the establishment of DHS to determine if new procedures are still adequate to address current security conditions or needs.
Assess the level of training within the IT department to determine if the skill base necessary to evaluate, test, maintain, and improve policies, plans, and procedures exists.
Evaluate IT staffing to determine if the staffing level and staffing mix are adequate to address current needs.
Determine the status of implementation of DRPs and what related training has been achieved.
Determine the status of implementation of IS security plans and what related training has been achieved.
Determine the status of implementation of computer-incident response plans and what related training has been achieved.
Determine the status of implementation of plans for the management of data privacy and what related training has been achieved.
Assess the level of training of IT users to determine what security related training should be implemented.

---